How detection works

What Reporight reads

• The repository record from GitHub's REST API, including the SPDX identifier GitHub publishes from its own detector.
• The license file GitHub points to, matched in full against reference license texts — and read for an SPDX-License-Identifier line if the project declares one there.
• The root directory listing, to spot additional LICENSE-* files, COPYING, and NOTICE.

Reporight does not scrape github.com pages, and it never touches private repositories.

Where the license knowledge comes from

Reporight matches against the ScanCode LicenseDB maintained by AboutCode: 821 SPDX identifiers with their license categories, and the full reference text of 50 licenses developers actually meet. Categories drive the family a license lands in, which is why a source-available license like SSPL is never quietly filed as open source.

That data is used under CC-BY-4.0. ScanCode Toolkit itself is Apache-2.0; Reporight does not bundle its code, only the published license data. Detection logic — the matching, scoring, and conflict handling — is Reporight's own, so mistakes here are ours, not AboutCode's.

What the deep scan does

• Downloads the repository archive once from codeload, reads it in memory, and stores nothing.
• Reads every text file: an SPDX-License-Identifier line first, then the notice patterns that appear in file headers, then full-text matching for files that are licenses in their own right.
• Attributes files with no notice of their own to the repository's license, which is how licensing actually works — so the percentages describe the whole tree.
• Flags what matters: copyleft inside a permissive project, source-available licenses, and vendored directories that carry their own terms.

Limits: 40,000 files, 120 MB of archive, and 180 seconds. A scan that hits one says so at the bottom of its report rather than quietly reporting a partial tree as the whole.

How confidence is decided

• High — the license text matches a reference license in full and GitHub's declaration agrees (or the text alone is a clean match).
• Medium — one signal is present without the other: GitHub declares a license Reporight could not verify from the text, the file declares its own SPDX identifier without carrying the full license text, or the text matches while GitHub declines to assert.
• Low — a partial match with nothing to corroborate it, a custom license, or conflicting signals.

When GitHub says one license and the file reads as another, Reporight reports a conflict and shows both. It will not quietly pick a winner.

Freshness

A repository's record is cached for 24 hours. “Rescan now” on any result page re-reads GitHub immediately, subject to fair-use throttling so Reporight stays within GitHub's API limits.

What this release does not do

• Dependency licensing. Reporight counts what manifests declare, but does not resolve those packages or read their licenses — that is a different job from scanning a tree.
• SBOM export, team policy workspaces, or CI policy checks.
• Private repositories, which need explicit OAuth consent Reporight does not yet ask for.
• Legal advice, in any form.